Local repair review, 2026-10-06
This review adds defensive regressions and source fixes. It does not approve production or native-dedicated PostgreSQL placement. Target tests ran with no external network, dummy identities, private scratch storage and resource limits. No retained runtime, shared service or production resource was changed.
The management routes recheck membership after reading a deferred request body, before writing function secrets, deployments, sign-in settings or database passwords. Awaited service logs and metrics also recheck authority before returning data; viewers retain metrics access but cannot read service logs. Installation operator routes apply the same check before creating an organization, changing update settings or requesting an update. A removed or demoted actor receives a refusal without publishing those changes.
A project move commits ownership only after its source keys are revoked. A key store failure rolls back ownership, queued jobs, audit and notification rows. Keys already revoked in their separate store remain revoked; retry can complete the move. Direct database passwords and internal signing secrets are outside this revocation operation, as before.
Studio assigns request paths and queries to the configured upstream URL without interpreting a double slash path as a different host. Existing session-cookie stripping and service-key authorization still apply.
Legacy offsite fetch requires the decrypted manifest creation timestamp to equal the requested backup name before publishing the files. A mismatch refuses and removes the staging files. Import preserves embedded double quotes in extension and schema identifiers while retaining the existing and inactive exclusions.
Generation migration requires the observed HBA rules to match its inventory before archival and completion, including retries. An old archive that did not verify that match cannot authorize completion. An absent retired container has no supported verified archive route: a new request refuses before publishing intent, and an existing intent remains a startup barrier. See the migration contract.
These changes have local regression evidence. Native runtime configuration, interrupted replacement recovery, PostgreSQL image changes, recovery after failed rollback, database/object backup coherence, capacity calibration and fresh-host restore remain separate acceptance work. See deployment readiness. Unit tests cannot establish those outcomes.
The console now shows inline validation for login, invitation creation and acceptance, names, gateway shares, function secrets and sign-in settings. Existing login passwords remain exact; new invitation passwords follow the server's 12 to 256 character policy. Network failures preserve form values and permit retry. GitHub repository, publisher account and Apache-2.0 links are visible in authentication screens and console navigation. Screenshot evidence uses a disposable demo catalog, not live Auth, databases or deployment services.